System for controlling the operation of modules using information transmitted from a control device via a data bus, a trigger device and a test circuit

ABSTRACT

In a data communication system, data is transmitted from a control device to a communication interface and from there via a communication bus to additional communication interfaces of trigger devices. The communication interface on the control device side has inputs, to which signals from said control device and a disarming switch can be assigned. The disarming switch can be circumvented by a bypass switch which is controlled by the control device. The state of the signal at the inputs of the communication interface on the control device side is transmitted to coresponding outputs of the communication interfaces of the triggger devices. A trigger device has a safety unit which is used to test at least one trigger unit, when the state of the signal of the outputs authorizes such a test and the trigger voltage source is not yet charged wth the full trigger voltage. In said state, the safety unit also blocks triggering as soon as the trigger voltage has been reached. The inventive system ensures a high degree of functional safety and flexibility.

CLAIM FOR PRIORITY

This application is a national stage of PCT/DE00/04410, published in theGerman language on Jun. 21, 2001, which claims the benefit of priorityto German Application No. DE 199 60 261.1, filed on Dec. 14, 1999.

TECHNICAL FIELD OF THE INVENTION

The invention relates to a system for controlling the operation ofmodules by transmitting information from a control device via a databus,and in particular for controlling the operation of firing devices of avehicle occupant protection apparatus in a motor vehicle. The inventionalso relates to a firing device for connection to the communications busof such a system and a safety circuit for a firing device of a vehicleoccupant protection system.

BACKGROUND OF THE INVENTION

A conventional system is disclosed in DE 197 39 808 A1. In this system,the code words which are transmitted from the control device to thecommunications interface contain an information section and anerror-detection section which contains, for example, the sum of bits ofthe information section. The information packet contains a bit whichcorresponds to the presence or non-presence of a safing signal generatedby a safing switch or safing sensor. If the code word transmitted by thecontrol device is to fire firing devices of a motor vehicle occupantprotection system, it contains, at a predetermined place in theinformation packet, a bit which corresponds to the presence of thesafing signal, i.e. requires the safing switch to be closed. Thisinformation bit is replaced in the communications interface by theinformation relating to the safing signal which is actually present atthe safing input so that, for example when there is informationcontained in the code word relating to the closed safing switch but whenthere is an absence of the safing signal at the safing input of thecommunications interface, the sum value in the code word no longercorresponds to the sum of the information packet and the code word canbe detected as faulty, as a result of which the firing devices do notfire.

In the known system, the safing signal which is present at the safinginput thus permits a safing function to be integrated into airbag firingsystems which operate with bus systems. When the safing switch isopened, firing is reliably prevented. However, in the known system, itis not possible to distinguish between firing instructions for differentfiring devices, for example firing devices for side airbags and firingdevices for front airbags. Furthermore, all the firing devices can befired only if the safing switch is closed.

SUMMARY OF THE INVENTION

The invention discloses developing a system in such a way that a largedegree of flexibility and reliability in terms of the actuationcapability of the individual modules is provided.

In one embodiment of: the system according to the invention, at thecontrol-device-end communications interface, a plurality of inputs whosesignal assignment is transmitted to corresponding outputs of themodule-end communications interface, information is present at themodule end which can be used in a wide variety of ways to enable anddisable functions which are to be triggered by means of the datatransmitted by the control module. In this way, flexible actuation ofthe individual module is possible. The transmission of the transmitteddata and the information in the code words can be protected in a similarway to that in the method according to DE 197 39 808, mentioned at thebeginning, check bits contained in the code words for checking thecorrectness of the information both increasing the reliability of thetransmission and enabling faults of the control device to be detected.The number of inputs of the control-device-end communications interfaceto which signals can be applied can be different from the number of themodule-end communications interface.

In one aspect of the invention, it is possible to enable functions ofthe modules as a function of the switch state of the safing switch.

In another aspect of the invention, the modules can advantageously beaddressed selectively by means of module-specific codes, as a result ofwhich the flexibility and reliability of their actuation capability isincreased further.

In another embodiment of the invention, a signal state is brought aboutwhich corresponds, on the one hand, to the closed safing switch, as aresult of which specific functions are enabled, and which corresponds,on the other hand, to the safing switch closed by means of a testsignal, and in addition to the presence of a test signal, as a result ofwhich functions, in particular test functions in which one or moremodules are in the same enabled state as in the case of a closed safingswitch, can take place.

The test output, in another aspect of the invention, of the module-endcommunications interface permits selective execution of functionalscopes, irrespective of the state of other outputs which are present.

In still another aspect of the invention, there is a way of triggeringthe individual safety devices for a vehicle occupant protection systemof a vehicle which is suitable for practical conditions.

In yet another aspect of the invention, there is a large degree ofreliability of the triggering of the safety devices to be triggered inthe event of a front-end impact against malfunctions of the controldevice. In addition, as is explained further below, the safety deviceswhich are to be triggered in the event of a front-end impact can bechecked.

In still another an embodiment of the system, no separate test input ofthe control-device-end communications interface is provided.

In one aspect of the invention, additional functional reliabilityadvantages to be obtained by virtue of the fact that, for example, afiring signal is generated in the control device if the safing input hasexperienced a level change.

In still another aspect of the invention, the basic design of a firstadvantageous embodiment of a firing device for connection to thecommunications bus: of the system according to the invention. Theembodiment of the firing device according to the invention ensures thata plurality of identical firing devices, embodied as what are referredto as “smart squibbs”, can be connected to the communications bus andselectively triggered.

In another embodiment, a firing device with whose safety circuit it ispossible to carry out functional checking as long as the firing voltagesource is still not charged to its firing voltage. If a test signal ispresent at the same time as a control signal, firing of the firingdevice is prevented.

According to one aspect, the safety switch, which constitutes a centralsafety element of the system, is advantageously monitored.

The invention is suitable for all systems of the generic type in whichslave modules are to be controlled by a master module via a databus asflexibly as possible and with a high degree of functional reliability.The invention is particularly suitable for use in vehicle occupantprotection systems.

The invention is explained further below by way of example and withfurther details with reference to the darwings, in which:

FIG. 1 shows a block circuit diagram of a first embodiment of the systemaccording to the invention.

FIG. 2 shows a block circuit diagram of a firing device.

FIG. 3 shows a circuit diagram explaining the function of the firingdevice according to FIG. 2.

FIG. 4 shows a block circuit diagram of a second embodiment of thesystem.

DETAILED DESCRIPTION OF THE INVENTION

According to FIG. 1, a control device 2 of a vehicle occupant protectionsystem is connected via a data line 4 to a communications interface 6which is connected to firing devices 9, 10 via a communications bus 8.The firing devices are embodied as what are referred to as “smartsquibbs” which have their own communications interface 12 and whosedesign is explained by reference to FIGS. 2 and 3. The system has aplurality of firing devices which are to be fired selectively on anindividual basis or in groups in the event of a front-end impact, a sideimpact, a roll-over etc.

The control device 2 controls a microprocessor which has associatedmemories and which determines instructions and/or information fromsensor input signals 22 which are generated by different accelerationsensors, said instructions and/or information being fed to thecommunications interface 6 via the data line 4.

In addition, a safing switch 26 which forms a redundancy switch andwhich closes by means of a predetermined vehicle deceleration so that,when the safing switch 26 is closed, current flows from a voltage source28, with for example 5 volts, through a resistor 30 and the safingswitch 26 so that a safing signal is present at a safing pin or safinginput 32 of the communications interface 6 which is connected to theconnection between the safing switch 26 and the resistor 30. In parallelwith the safing switch 26 there is a normally open bypass switch 34which is formed, for example, by a transistor and which is connected toa voltage divider circuit formed from two resistors 36 and 38 connectedin series. The one resistor 38 is connected to ground and the otherresistor 36 is connected to a test output 40 of the control device 2,which is in turn connected to a test input 42 of the communicationsinterface 6.

The connection between the safing switch 26 and the resistor 30 isadditionally connected to an input 44 of the control device 2.

The control device 2 also has a control output 46 which is connected toa further pin or a control input 48 of the communications interface 6.

The design and function of the individually described components andfunction blocks are known per se and are not explained.

The transmission of the information of the instructions of the controldevice 2 and of the signal states of the inputs 32, 42 and 48 which aresent via the data line 4 takes place in a manner known per se, it beingpossible for this data to be checked for correctness in a manner knownper se by means of the division of the individual code words intoinformation packets and check packets. If it is detected, for example,in the communications interface 6 that the input 42 has a signal appliedto it, but this is not the case at the input 32, a fault in the systemcan be identified immediately by acknowledgement by the data line 4 tothe control device 2. Furthermore, the control device 2 can be embodied,for example, in such a way that it sends a firing instruction for firingthe firing device 18 or devices 18 only if a safing signal is present atits input 44. Furthermore, the transmission of a firing instruction canadditionally be protected by the fact that a firing pulse is transmittedonly after a signal change has been detected at the input 44 or at theinput 32 without a signal change being present at the input 42.

If, for example in the case of test signal generated as a result of afault in the control device 2, i.e. test input 42 with a signal appliedto it, a firing signal is transmitted via the data line 4, this does notcause the firing device to fire as explained below because the testinput 42 forms a DISABLE input. In this way, it is at least largelypossible to prevent faults in the firing device 2 leading to inadvertentfiring of a firing device.

The design of an advantageous exemplary embodiment of the firing devices9, 10 which are advantageously embodied in the same way is describedbelow with reference to FIG. 2.

The communications interface 12 which is connected to the communicationsbus 8 has a safing output 32 ₁, a test output 42 ₁ and a control output48 ₁. The code words which are transmitted via the communications bus 8are each read out by the communications interface 12 in such a way thatthe signal state at the outputs 32 ₁, 42 ₁ and 48 ₁, corresponds to thesignal states at the inputs 32, 42, 48 of the communications interface6.

In the firing device 16 there is a switching device 50 whose inputs areconnected to the outputs 32 ₁ and 48 ₁. A firing signal output 52 of thecommunications interface 12, to which firing signal output 52 a firingsignal sent by the control device 2 via the data line 4 is transmitted,is connected to a firing input 53. A code input 54 is connected to acode signal output 55 which conducts identification signals and codesignals which are individually assigned to the firing devices and aretransmitted by the control device 2.

The firing devices are each provided with an individual code, forexample by programming a memory contained in them so that they detect acode signal which is respectively assigned to them.

The coding of a firing device can also be carried out by virtue of thefact that a resistor, at which a predetermined voltage drops when thecode signal is present, is connected downstream of the code input 54,said voltage serving to activate a code switch. The presence orintactness of such a resistor can be checked from the control device 2,as a result of which the functional reliability of the system is furtherimproved.

The further design and function of the switching device 50 is explainedwith reference to FIG. 3:

The input of a code switch 56 is connected to a firing voltage source58. The code switch 56 has two outputs, of which one is connected to theinput of a firing switch 60 via a control switch 56 which can be drivenby the control output 48 ₁, and the other is connected to the input ofthe firing switch 60 via a safing switch 61 which can be driven from thesafing output 32 ₁. The output of the firing switch 60 is connected to afiring unit 62, embodied for example as a firing cap.

The function of the switching device 50 which is described is such thatthe code: signal present at the input 54 defines thecontrol-device-specific positioning of the code switch 56, i.e. whetherthe branch with the control switch 59 or the branch with the safingswitch 61 is activated. When the control switch 59 is activated, acontrol signal which is present at the control output 48, leads to theclosing of the control switch 59 so that a firing signal 53 which closesthe firing switch 60 fires the firing unit 62 when the firing voltagesource 58 is charged. On the other hand, when the safing switch 61 isactivated, a signal at the safing output 32 ₁ causes the firing output62 to fire when there is a firing signal.

If a plurality of firing devices equipped with the control circuit 50described are connected to the communications bus 8, it is thereforepossible to determine by means of the code signal whether the firingdevices are activated via the control output 48 ₁ and/or the safingoutput 32 ₁ so that they fire correspondingly.

An exemplary assignment is that firing devices which are activated viathe control output 48 ₁ are firing devices which fire when there is aside impact, whereas firing devices which are to fire in the event of afront-end impact are activated via the safing output 32 ₁. The switches59 and 61 thus constitute, in a certain way, safing switches which areassigned to a side impact or a front-end impact. In addition, the firingdevice contains a safety switching device 63 with an AND element 64whose inputs are connected to the firing voltage source 58 and the testoutput 48 ₁ and whose output is connected to the input of a safetyswitch 66 which is formed, for example, from a transistor. The safetyswitch 66 connects the safing output 32 ₁ to ground when there is asignal from the AND element 64 so that a signal which is present at thesafing output 32 ₁ becomes ineffective for the switching device 50. Inorder to monitor the state of the safety switch 66 or of the safingoutput 32 ₁, a monitoring device 68 is provided whose output signal isdisplayed immediately and/or can be sensed additionally by the controldevice 2.

The design and function of the individual assemblies or functionalelements are known per se and are therefore not explained in particular.

The function of the safety device 63 is explained below. It is assumedhere that, after the system is switched on, for example via thecommunications bus 8, the firing voltage source 58 is gradually chargedto the firing voltage.

The safing output 32 ₁ may have a safing signal (front-end impact)applied to it so that when there is a corresponding code the switch 61is closed and the firing unit 62 fires when there is a firing signal ifthe test output 42 ₁ does not have a signal applied to it. However, if atest signal is present and the firing voltage source 58 is charged toits firing voltage, the AND element 64 supplies an output signal, as aresult of which the safety switch 66 closes and connects the safingoutput 32, to ground, as a result of which in turn the switch 60 isprevented from closing. A test signal thus constitutes an ENABLE signalin terms of the firing. If the firing voltage source 58 has still notreached the firing voltage after the system is put into operation (thefiring voltage source 58 contains a charging capacitor), the AND element64 does not supply an output signal because there is inequality betweenthe voltage at the test output 42 ₁ and the voltage of the firingvoltage source 58 in this state. It is in any case impossible for thefiring device 18 to fire with inadequate voltage. However, by using afiring pulse or test pulse generated by the control device it ispossible to test the firing unit 68 because the switches 56, 61 and 60bring about a current path from the voltage source 58 to the firing unit62.

If a plurality of firing devices are connected in accordance with FIG. 2to the communications bus 8 in FIG. 1, a vehicle occupant protectionsystem can thus be brought about in which a number of firing devices(closed switch 61) fire only when there is a front-end impact (safingoutput 32 ₁), and other firing devices (switch 59 closed) fire whenthere are impacts other than front-end impacts, the firing of saidfiring devices being secured via the control output 48 ₁. The controldevices which fire when there is a front-end impact can be additionallychecked in terms of their function using the test output 32 ₁, firingbeing reliably prevented when there is a functional check.

It goes without saying that the system described can be changed indifferent ways. For example, it is not absolutely necessary to integratea firing-device-specific identification; however, it increases theflexibility of the system because firing devices can be addressedselectively. The switching device 50 can contain a plurality of switchesso that it is possible, for example, to fire all the firing devices inthe case of a front-end impact, whereas only respectively assignedfiring devices are fired in the case of other impacts. Alternatively, itis also possible to use other firing devices which are connected to acommon communications interface 12.

The firing input 53 can be dispensed with if the firing signal comesdirectly via the output 48 ₁ or 32 ₁ and closes corresponding switcheswhich connected the firing voltage source to the firing unit.

It goes without saying that the block circuit diagram in FIG. 2 is alsoschematic and can be modified in various ways. For example, a pluralityof firing units may be provided per firing device. FIG. 4 shows amodified embodiment of the system according to FIG. 1, the samereference symbols being used for functionally similar parts.

The essential difference from the embodiment according to FIG. 3 andthat according to FIG. 1 is that in the embodiment according to FIG. 3the test input 42 is absent and in its place the test output 40 isconnected via a further voltage divider circuit with resistors 70 and 72to a switch 74 which is formed, for example, by a transistor, can beactuated electronically and is connected to the control input 48.

The circuit ensures that when a test pulse generated by the controldevice 2 is present at the test output 40 or when there is a pulse atthe output 40 (which does not necessarily need to be a test output) forclosing the switches 34 and 74 at the inputs 32 and 48, in each case thesame voltages or signals are present as when the safing switch 26 closesor when there is a control signal present at the control output 46.

With only two pins or inputs 32 and 48 of the communications interface 6to which corresponding outputs 32 ₁ and 48 ₁ of the decoding device 10correspond, it is possible to secure four functional scopes, for exampleaccording to the following table:

State Safing input 32 Control input 48 Enabling/disabling I 0 0 Enablingtest Firing in case of front-end impact II 0 1 Enabling firing in caseof non-front- end impact III 1 0 Disabling of firings IV 1 1 Enabling offirings

As is apparent, the firing device or devices which are assigned to afront-end impact can be tested and the firing device or devices whichare not assigned to a front-end impact can be fired independently of thefiring devices to be fired in the event of a front-end impact. Theoutput 40 in the embodiment according to FIG. 3 is therefore not a testoutput in the true sense but rather an additional control output withwhich functions can be disabled or enabled.

The circuit of the firing device or devices is correspondingly embodiedso that the corresponding functions can be disabled or enabled with thesignal states explained in table 2 at their outputs 32 ₁ and 48 ₁.

It goes without saying that the circuits which are explained by way ofexample can be modified in various ways if only the essential ideas ofthe invention are implemented, i.e. the generation of signal states atthe control-device-end communications interface 6 which are transmittedvia the communications bus 8 to the communications interface 12 and areavailable there for disabling or enabling functional states which aretriggered by means of corresponding instructions.

An input of the control-device-end communications interface is connectedto a safing switch, it being possible to bypass the safing switch bymeans of a bypass switch which can be driven by an output of the controldevice. The output of the safing switch is connected to an input of thecontrol device, it being possible, in contrast to the embodimentsillustrated, for this input to be inverting, i.e. to have the voltagezero applied to it when the safing switch is closed.

An output-end control device has a device with which it is possible totest a firing device with predetermined application of signals to theoutputs of the firing-device-end communications interface as long as thevoltage source has not yet reached its firing voltage, and in the statein which the test capability is enabled the firing capability isautomatically disabled as soon as the voltage source has reached itsfiring voltage.

Alternatively, the communications interface of the firing devices can,as shown in FIG. 2, be embodied with three outputs, and the applicationsof signals to the inputs 32 and 48 of the control device of FIG. 4,which are transmitted via the communications bus, can be converted intothe following applications of signals by appropriately embodying thecommunications interface 12:

K-interface 6 K-interface 12 (FIG. 4) (FIG. 2) State 32 48 32₁ 48₁ 42₁ I0 0 1 0 1 II 0 1 1 1 0 III 1 0 0 0 0 IV 1 1 0 1 0

As a result, with the embodiment of the control device and of thecircuits connected downstream of it according to FIG. 1 and theembodiment of the firing device according to FIG. 2 it is possible tocarry out all the functions explained in conjunction with these figures.

Only two additional bits included in the code words have to betransmitted via the communications bus, said bits corresponding in eachcase to one of the inputs 32 and 48 and their signal state being asindicated in the table above. The information contained in the (controland signal) bits is converted in the communications interface 12 intothe application of signals to the outputs 32 ₁, 48 ₁ and 42 ₁ which isindicated in the table.

1. A system for controlling the operation of modules by transmittinginformation from a control device via a databus, comprising: acommunications interface which is connected to the control device via adata line and has an input, which communications interface converts datatransmitted by the control module into code words which are transmittedvia a communications bus and which includes information relating to thedata and a signal state of the input, wherein the communicationsinterface connected to the control device has a plurality of inputs towhich signals are configured to be applied, and the communications busis connected to the modules via a module-end communications interfacewhich has a plurality of outputs to which signals are configured to beapplied, the signal state of the inputs being transmitted to the outputsvia the communications bus such that there is a predeterminedrelationship between the signal states of the inputs and outputs, suchthat functions of the modules are disabled and enabled by means of thesignal states of the inputs.
 2. The system as claimed in claim 1,wherein the communications interface which is connected to the controldevice has a safing input which is connected to a safing switch and acontrol input which is connected to a control output, to which a controlsignal can be applied, of the control device and in that that thecommunications bus is connected to the modules via a module-endcommunications interface which has a safing output and a control output,the signal state of the safing input or of the control input beingavailable at the safing output or the control output to disable orenable functions of the modules.
 3. The system as claimed in claim 1,wherein the modules can be addressed selectively by means of a code. 4.A system for controlling the operation of modules by transmittinginformation from a control device via a databus, comprising: acommunications interface which is connected to the control device via adata line and has a sating input connected to a safing switch, whichcommunications interface converts data transmitted by the control moduleinto code words which are transmitted via the communications bus andwhich include information relating to the data and a signal state of thesafing input, wherein the control devices has a test output to which atest signal is configured to be applied from the control device andwhich is connected to a further input of the communications interface,and a bypass switch is provided parallel to the safing switch such thatwhen the test signal generated by the control device is present a signalstate corresponding to the closed safing switch is present at the safinginput irrespective of the switch state of the safing switch, and thecommunications bus is connected to the modules via a module-endcommunications interface which has a safing output and at least onefurther output, the signal state of the safing input or of the furtherinput being available at the safing output or further output to disableor enable functions of the modules.
 5. The system as claimed in claim 4,wherein the test output of the control device is directly connected to atest input of the communications interface, and the further output ofthe module-end communications interface is formed by a test output. 6.The system as claimed in claim 5, wherein safety devices which triggerwhen there is a front-end impact are configured to be triggered when thesafing switch is closed and safety devices which trigger when there is aside impact are configured to trigger when the safing switch is open. 7.The system as claimed in claim 6, wherein when a test signal is presentthe triggering capability of the safety devices which trigger when thereis a front-end impact is disabled.
 8. The system as claimed in claim 4,wherein the control input is connected to the test output via aswitching device such that when there is a test signal present a signalstate which corresponds to the presence of a control signal is presentat the control input.
 9. The system as claimed in claim 8, wherein thefollowing relationships exist between the signal states at the inputs ofthe control-device-end communications interface and the possibility ofenabling or disabling functions: when the safing input and control inputequal 0, enabling firing in the event of front end impact, when thesafing input equal 0 and the control input equals 1, enabling firing inthe event of non-front-end impact, when the safing input equal 1 and thecontrol input equals 0, disabling firings, and when the safing inputequal 1 and the control input equals 1, enabling all firings.
 10. Thesystem as claimed in claim 9, wherein the control-device-endcommunications interface transmits the signal state of its inputs to thecontrol device.
 11. A firing device for connection to the communicationsbus of a system as claimed in claim 3, wherein the communicationsinterface which is configured to be connected to the communications busand has a safing output, the control output, a code signal output with afiring signal output, a switching device which has a safing switch whichcan be activated by the safing output, a control switch which can beactivated by control output, a code input with a firing input, afiring-device-specific code signal present at the coding inputdetermining which of the switches is activated, and a firing signalleading to firing of a firing unit when the safing switch is activatedand a safing signal is present and/or control switch is activated and/ora control signal is present, and a safety circuit with an AND elementwhose inputs are connected to the test output and to the firing voltagesource and whose output is connected to a safety switch which connectsthe safing output to ground if a test signal is applied to the testoutput and the firing voltage source has a voltage which is notsufficient to fire the firing unit.
 12. A firing device for connectionto the communications bus of a system as claimed in claim 5, wherein thecommunications interface which can be connected to the communicationsbus and has the safing output, the test output, a safing switch whichcan be activated by the safing output and which connects a firingvoltage sources to a firing unit when there is a signal at the safingoutput and a firing signal is present, and a safety circuit with an ANDelement whose inputs are connected to the test output and to the firingvoltage source and whose output is connected to a safety switch whichconnects the safing output to ground if a test signal is applied to thetest output and the firing voltage source has a voltage which is notsufficient to fire the firing unit.
 13. The system as claimed in claim11, wherein a monitoring device for the safety switch is provided.
 14. Asafety circuit for a firing device of a vehicle occupant protectionsystem, comprising: an input to which a signal can be applied and a testinput to which a test signal can be applied; and an AND element havinginputs connected to the test output and to a firing voltage source andhaving an output connected to a safety switch which connects the inputto ground if a test signal is applied to the test output and the firingvoltage source has a voltage which is not sufficient to fire the firingunit.